PT-2023-3656 · Apache · Apache Airflow Mysql Provider+1
Id_No2015429
·
Publicado
2023-06-26
·
Atualizado
2023-07-06
·
CVE-2023-35798
CVSS v3.1
4.3
Média
| Vetor | AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N |
Name of the Vulnerable Software and Affected Versions
Apache Airflow ODBC Provider versions prior to 4.0.0
Apache Airflow MSSQL Provider versions prior to 3.4.1
Description
The issue is related to insufficient input validation in the Apache Airflow MSSQL Provider and Airflow ODBC Provider modules. This allows a remote attacker to access protected information. The vulnerability is considered low because it requires DAG code to use
get sqlalchemy connection and someone with access to connection resources to update the connection and exploit it.Recommendations
For Apache Airflow ODBC Provider versions prior to 4.0.0, upgrade to a version that is not affected.
For Apache Airflow MSSQL Provider versions prior to 3.4.1, upgrade to a version that is not affected.
As a temporary workaround, consider restricting access to the
get sqlalchemy connection function until a patch is available.Correção
RCE
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Apache Airflow Mysql Provider
Apache Airflow Odbc Provider